Slide 14 of 27
Part 3 · ScenariosSlide 14
PART 3
Scenarios
Slides 14–17 · OWASP’s official attack examples, made concrete
Slide 14 · Scenario 1
Variable-length inputs overwhelm the system.
OWASP Scenario #1, retold concretely.
OWASP SCENARIO #1
Context Window Saturation via Variable-Length Input

An attacker identifies that a document-analysis application accepts user-uploaded text with no size limit. They begin submitting inputs that increase in size with each request — first 10KB, then 100KB, then the full context window size. Each request drives the model into its maximum memory usage and slowest execution path.

Even at low request volume, the model is fully occupied processing each oversized input. Other users’ requests queue up and time out. From the outside, it looks like the service is degraded. No crash — just saturation.

Why it matters: input size limits are the most basic control against this attack. Without a character or token ceiling on what the application accepts, any user — malicious or just careless — can trigger this condition.
The Real-World Parallel

The Sourcegraph incident (Slide 10) demonstrates the resource-exhaustion outcome at scale: a proxy that removed all usage ceilings led to 2 million API calls, degrading service for legitimate users who had their rate limits cut as a consequence.

← BackNext → Scenario 2